[renmengye]

Trajectory step 5: a keyed attestation at the end of each run. Stacked on #594, which is stacked on #593.

• Key: 32 random bytes in trajectory_attest.key beside the operator settings file (paths.env_file().parent). It's created owner-only (0600) on first use, never inside a run directory or workspace, and never logged.
• Event: right after the ending event, attempt.finish_run appends one attest event: {"head": sha256 of the preceding line, "alg": "hmac-sha256", "mac": HMAC(key, run_id + "\n" + head)}. It is computed under the same lock as every append, and best-effort: no key means a warning and no event.
• Check: outerloop trajectory <run> --verify prints attested when the last attest event recomputes with this deployment's key. A mismatch is a problem and exits 1. Older runs, or no key, print nothing extra.
• What it proves: that this deployment's chain was not changed after the run ended. It is not a public proof: per the PI's decision E, there is no public hash log in 0.6. Per decision D, it's HMAC first. The ledger copy of the head waits for 0.7, because 0.6 is the first kernel that ignores unknown ledger fields.
• Tests: they never touch the runner's real config. An autouse guard uses its own MonkeyPatch, so a test's monkeypatch.undo() can't remove it. An earlier draft leaked a key into ~/.config/outerloop exactly that way; it's fixed, and the key was removed.

Gate: ruff check, ruff format --check, mypy, pytest (3082 passed, 7 skipped).

Built by DeepSeek-V4.1-Flash, with the test guard fixed by Claude; reviewed by Claude.

[github-actions]

Round 1 — reviewed head 7ff16887 — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

The attestation check does not reject data appended after the signed chain head.

[github-actions]

Round 2 (re-run on the same head) — reviewed head 7ff16887 — reviewer summarizer:hermes/gpt-5.6-terra over coverage+credentials+deployment+general+lifecycle+prose.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: 1 blocking, 0 advisory.

1 finding attached to the lines below.

One blocking attestation-integrity defect: check_attest accepts a valid chain extended after its signed ending. Rejected as duplicates: the six lens-specific findings (coverage, credentials, deployment, general, lifecycle, and prose) all describe the same src/outerloop/trajectory.py:164 defect and were consolidated into the merged finding; none were rejected as mistaken.

[github-actions]

Round 3 — reviewed head d32c521a — reviewer hermes/gpt-5.6-terra.

terra
Advisory findings from outerloop — the code owner decides. Reply to disagree; the outerloop:no-review label opts this PR out.

Verdict: nothing blocking — 1 advisory note.

1 finding attached to the lines below.

Concurrent first-use key creation can leave one completed run unattested.